MSP cybersecurity news digest, April 27, 2026

This report summarizes multiple active threats: UNC6692 abused Microsoft Teams and helpdesk impersonation to deliver a Snow malware toolkit (backdoor, tunneler, malicious browser extension); Bitwarden’s CLI npm package was briefly poisoned to harvest developer secrets; OAuth-based phishing is being used to hijack Microsoft 365 via malicious apps; Trigona deployed a custom exfiltration tool ahead of ransomware activity; and ADT experienced a data breach tied to ShinyHunters — collectively highlighting supply-chain risks, token-based persistence, stealthy exfiltration, and identity-focused intrusions.